Fuzzgrind: An automatic fuzzing tool

No ratings

Presented at HackLu 2009 by

Fuzzing is a testing technique that provides invalid, unexpected, or random data to the inputs of a program. Despite being extremely powerful, fuzzing has many drawbacks, the most important one being the time required to develop fuzzers. In the case of model description based fuzzing, writing the model is a never ending process: protocol specifications must be analysed or reversed if unavailable, etc. Moreover, different fuzzers must be developed for each new target. Fuzzgrind is a fully automatic fuzzing tool, generating test files with the purpose of discovering new execution paths likely to trigger bugs, and potentially vulnerabilities. Fuzzgrind is based on the concept of symbolic execution. Thus, the tool starts from a file considered valid by the software under test, and analyses the execution path to extract any constraints tied to branch instructions followed by this software. By resolving constraints one by one, Fuzzgrind will alter the valid file to explore possible new branches of the software under test, in order to discover new vulnerabilities. Fuzzgrind is based on two free software programs: Valgrind, a dynamic binary instrumentation framework; and STP, a fast constraint solver. A plug-in has been developed for Valgrind which tracks path conditions tied to the input file while tested software is being executed. STP solves each encountered constraint to generate new test files that will explore new execution paths on future execution. This technique seems particularly effective, especially since it is sufficient to provide a valid file and the target software, and let Fuzzgrind begin to search bugs automatically. Some vulnerabilities have been discovered or rediscovered in small Unix tools and libraries.